netdev - Re: [PATCH net-next] net: wwan: core: Return poll error in case of port removal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 22 Apr 2021 13:49:32 +0300
From:   Leon Romanovsky <leon@...nel.org>
To:     Loic Poulain <loic.poulain@...aro.org>
Cc:     kuba@...nel.org, davem@...emloft.net, netdev@...r.kernel.org
Subject: Re: [PATCH net-next] net: wwan: core: Return poll error in case of
 port removal

On Thu, Apr 22, 2021 at 11:43:34AM +0200, Loic Poulain wrote:
> Ensure that the poll system call returns error flags when port is
> removed, allowing user side to properly fail, without trying read
> or write. Port removal leads to nullified port operations, add a
> is_port_connected() helper to safely check the status.
> 
> Fixes: 9a44c1cc6388 ("net: Add a WWAN subsystem")
> Signed-off-by: Loic Poulain <loic.poulain@...aro.org>
> ---
>  drivers/net/wwan/wwan_core.c | 17 +++++++++++++++--
>  1 file changed, 15 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/wwan/wwan_core.c b/drivers/net/wwan/wwan_core.c
> index 5be5e1e..c965b21 100644
> --- a/drivers/net/wwan/wwan_core.c
> +++ b/drivers/net/wwan/wwan_core.c
> @@ -369,14 +369,25 @@ static int wwan_port_op_tx(struct wwan_port *port, struct sk_buff *skb)
>  	return ret;
>  }
>  
> +static bool is_port_connected(struct wwan_port *port)
> +{
> +	bool connected;
> +
> +	mutex_lock(&port->ops_lock);
> +	connected = !!port->ops;
> +	mutex_unlock(&port->ops_lock);
> +
> +	return connected;
> +}

The above can't be correct. What prevents to change the status of
port->ops right before or after your mutex_lock/mutex_unlock?

> +
>  static bool is_read_blocked(struct wwan_port *port)
>  {
> -	return skb_queue_empty(&port->rxq) && port->ops;
> +	return skb_queue_empty(&port->rxq) && is_port_connected(port);
>  }
>  
>  static bool is_write_blocked(struct wwan_port *port)
>  {
> -	return test_bit(WWAN_PORT_TX_OFF, &port->flags) && port->ops;
> +	return test_bit(WWAN_PORT_TX_OFF, &port->flags) && is_port_connected(port);
>  }
>  
>  static int wwan_wait_rx(struct wwan_port *port, bool nonblock)
> @@ -508,6 +519,8 @@ static __poll_t wwan_port_fops_poll(struct file *filp, poll_table *wait)
>  		mask |= EPOLLOUT | EPOLLWRNORM;
>  	if (!is_read_blocked(port))
>  		mask |= EPOLLIN | EPOLLRDNORM;
> +	if (!is_port_connected(port))
> +		mask |= EPOLLHUP | EPOLLERR;
>  
>  	return mask;
>  }
> -- 
> 2.7.4
>